Missing brain cells

[Aaron Sakovich]

Hi,

Something's not clicking today. I've got a system running DECnet Plus that I wanted to get rid of all my proxies on. No sweat -- a few iterations of Remove /Proxy got them. Most of them.

Now I'm left with all the Phase IV proxies in the NetProxy.dat file. I can't remember what I need to do to get rid of them! I could just delete the NetProxy.dat file, then re-create it with a Create/Proxy, but isn't there a way to just delete the entries?

If I see a proxy like "Buzz::Woody Woody" and I try to Remove/Proxy Buzz::Woody, it comes back and says "SECSRV-E-NOSUCHPROXY, no proxy record matches your specification". I'm guessing it's actually looking for "Local:.Buzz::Woody" in Net$Proxy.dat and not "Buzz::Woody" in NetProxy.dat.

So, how do I get rid of entries in NetProxy.dat? Why didn't removing the Phase V proxies remove the Phase IV ones, too?

Flustered,
Aaron

[Hoff · Accepted solution]

Is there lowercase in the spec? Can you post the SHOW /PROXY on the offending spec? And a SHOW /PROXY /OLD for the same?

I'd be tempted to try tossing whatever wildcard deletion operations are accepted.

The brute-force approach here is to shut down DECnet, blow away netproxy and net$proxy, then create/proxy to recreate them, then restart.

It is also worth a look around the ECO area, as there have been a few similar reports over the years, an there might well be an ECO for OpenVMS and/or DECnet-Plus available for whatever versions are in use here.

Stephen Hoffman
HoffmanLabs

[Aaron Sakovich]

Here's some pertinent output for you to digest late on a Friday...

UAF> show /proxy *

Default proxies are flagged with (D)

LOCAL:.VENUS::SAKOVICH
SAKOVICH (D)

BUZZ::SAKOVICH
SAKOVICH (D)
UAF> show /proxy buzz::sakovich
%SECSRV-E-NOSUCHPROXY, no proxy record matches your specification
UAF> remove/proxy buzz::sakovich
%UAF-E-NAFREMERR, error removing proxy from LOCAL:.BUZZ::SAKOVICH to *
-SECSRV-E-NOSUCHPROXY, no proxy record matches your specification

[Bill Hall]

Aaron,

I think I may be missing the same brain cells as I have seen this a long time ago after DECnet phase IV to V conversions, but can't remember exactly how we got the proxies removed. The problem as I recall is with authorize trying to do name resolution of a phase IV node name that did not exist in the NETNODE_REMOTE.DAT file at the time of the DECnet V conversion.

We may have temporarily disabled the DNS clerk and then been able to remove the old phase IV proxies. Or you might use DECNET_REGISTER to enter a temporary namespace entry for local::.buzz. Then try to remove the proxy.

Bill

[Hoff]

I think there might be a bug here. I recall a previous discussion or two in this area over the years.

SHOW /PROXY /OLD output?

Not sure if there's a REMOVE /PROXY /OLD. (Not?)

Another approach is to open up NETPROXY directly yourself, and go hunting.

[Colin Butcher]

Ahh yes.

Which versions are you running? There's been all sorts of "fun" in this area over time. Personally I've never really liked the way that the proxy database works under Phase V - it always wants the entire fullname string, never the short alias name string. It seems to attempt all the translations / name resolutions before it goes near the file. I think it would be much better if it were to allow the use of short alias names and old-style Phase IV names in the file, then do all the lookups outside the file, but there you go.

Easiest solution is to trash the proxy database, then recreate it with a DCL command file. For example:

$ say "... Creating a new proxy file."
$ !
$ if f$search(proj_proxy_file) .nes. "" then delete/nolog/noconf 'proj_proxy_file';*
$ open/write proxy 'proj_proxy_file'
$ proxydef :== "write proxy"
$ proxydef "$ set noon"
$ proxydef "$ !"
$ proxydef "$ ! Wipe out old proxy database"
$ proxydef "$ !"
$ proxydef "$ set server security_server /exit"
$ proxydef "$ wait 00:00:05.00"
$ proxydef "$ delete/noconfirm/nolog netproxy:;*"
$ proxydef "$ delete/noconfirm/nolog net$proxy:;*"
$ proxydef "$ set server security_server /start"
$ proxydef "$ wait 00:00:05.00"
$ proxydef "$ !"
$ proxydef "$ ! Create new proxy database"
$ proxydef "$ !"
$ proxydef "$ define/user sys$output nl:"
$ proxydef "$ define/user sys$error nl:"
$ proxydef "$ mcr authorize"
$ proxydef "!"
$ proxydef "create /proxy"
$ proxydef "!"

... add all the new proxies you need

$ proxydef "!"
$ proxydef "! All done"
$ proxydef "!"
$ proxydef "exit"
$ proxydef "$ exit"
$ close proxy

Then run the resulting command file once you're happy with it.

Cheers, Colin (www.xdelta.co.uk).

[Hoff]

Here are some details on the sequence used within DECnet-Plus for proxy operations; on the NCL-based session connection name search path: http://forums1.itrc.hp.com/service/forums/questionanswer.do?threadId=992091

[Aaron Sakovich]

I think we're all on the same page -- the idea is to blow away the old NetProxy.dat file and if necessary, repopulate it. There are lots of ways of doing it (Colin's is pretty automated, but the number of steps overall are small enough to do by hand.)

Thanks folks -- nice to know I've not gone senile. Yet.

[Aaron Sakovich]

In closing, I just want to apologize for the lame title of this thread...

No excuses, I knew better.